Do Son 
At a Glance
| Malware family | Poisoned Refresh (Linux rootkit implant) |
| Threat actor | Unconfirmed (tracked by F5 as activity cluster c05d5254) |
| Target or victims | F5 BIG-IP Access Policy Management (APM) environments |
| Delivery vector | Exploitation of unauthenticated RCE flaw CVE-2025-53521 |
| Key capabilities | Custom ELF loader, memory patching, fileless PHP web shell, local UNIX socket shell |
| Source | SophosLabs, ESET, F5 Networks |
TL;DR
Security researchers at SophosLabs analyzed a stealthy Linux implant targeting F5 BIG-IP Access Policy Management systems. The threat operates as an in-memory PHP web server rootkit that hooks Apache processes without altering files on disk. Additionally, the malware provides backdoor access through a hidden local UNIX socket.
Delivery
Attackers gain initial access by exploiting a critical vulnerability in F5 BIG-IP appliances. Specifically, the activity links to CVE-2025-53521, an unauthenticated remote code execution flaw in the BIG-IP Access Policy Management module. F5 tracks this adversary activity under the cluster name c05d5254. Threat actors target network perimeters where an access policy runs on a public virtual server.
Following the initial breach, the attackers deploy an installer component. Security researchers identified this component inside a modified Linux umount utility. This first-stage loader establishes persistence across system upgrade workflows under the installation directory. In addition, the installer modifies SELinux configurations to allow unauthorized process manipulation. It then infects the Apache web server executable directly on the storage volume.
Infection Chain
The second-stage payload executes when the Apache web server daemon starts. Instead of calling standard system libraries, the binary branches into a custom ELF loader. This custom loader parses its own binary headers and maps necessary code segments into memory. Next, it intercepts the initial process startup sequence before the application reaches its main entry point.
The implant then monitors the Apache Portable Runtime library. Specifically, it hooks module loading functions and waits for Apache to load the PHP interpreter module. The malware takes action only after detecting the presence of this specific runtime component. SophosLabs confirmed this targeted behavior in their technical breakdown. The report noted, “The malware targets deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows.”
Once the PHP module loads, the Linux PHP web server rootkit alters runtime memory tables. It reads system process mappings to locate the module in memory. Then, it modifies memory permissions and redirects core file handling functions. Whenever the web server reads specific legitimate script files, the implant intercepts the memory mapping routine. It injects a fileless web shell directly into memory ahead of the real script contents. Consequently, the actual files on disk remain completely unmodified and appear clean to scanners. As SophosLabs explained, “The on-disk file does not need to contain the final web shell content at all; execution follows from the modified in-memory representation created by the implant at runtime.”
Command-and-Control and Data-Exfiltration Behaviour
The backdoor provides two distinct command channels for remote operators. First, the in-memory web shell processes incoming HTTP requests sent to legitimate portal files. The implant inspects the raw request payload for a specific authentication prefix. If the prefix matches, it decrypts the incoming command data using a stream cipher. Next, it evaluates the script code and returns a fake stylesheet response with an HTTP 201 status code. This behavior mimics ordinary web traffic and bypasses standard application monitoring.
Second, the malware establishes an interactive local backdoor. It hooks time calculation routines to trigger a secondary worker process. This worker creates a local UNIX domain socket in the system runtime directory. Attackers who authenticate with a hardcoded token receive an interactive shell session without opening any listening network ports. Security vendor ESET independently tracked overlapping campaign activity under the name Poisoned Refresh. Researchers observed that the threat actor uses this dual-channel design to evade network detection while maintaining persistent administrative access.
Defense or Detection Guidance
System administrators should assess their BIG-IP appliances for potential intrusion indicators immediately. First, organizations running vulnerable versions must apply official remediation guidance from F5 Networks. Verify firmware integrity and inspect upgrade staging directories for unauthorized files. Because the implant resides in memory, standard file integrity checkers cannot detect the active web shell on disk.
Therefore, security teams must inspect running processes and memory mappings for anomalous permission changes. Look for Apache worker processes accessing process maps followed by executable memory alterations. In addition, monitor system sockets for unexpected UNIX domain socket listeners under runtime directories. Network defenders should also audit authentication logs for abnormal shell executions originating from web server accounts.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
